Panorama

1. Define tunnel settings and, optionally, QoS settings for your remote network.

   During setup, you select an IPSec tunnel and a QoS profile. You can define these settings during initial setup, but it can be easier to define those settings before you begin.

   1. Define IPSec tunnel settings for your remote networks by creating a new IPSec Tunnel and configuring the IKE Gateway, IPSec Crypto Profile, and Tunnel Monitoring settings.

      Make a note of these settings (including pre-shared keys (PSKs) if you use them); you must match the settings on the customer premises equipment (CPE) that terminates the IPSec tunnel at your site.

      Be sure that you create the tunnel settings in the Remote_Network_Template.

      You can also use one of the predefined IPSec templates in the Remote_Network_Template; in this case, you don’t need to define tunnel settings.
   2. (Optional) Decide whether you want to add QoS settings to your remote network deployment; if you do; create a QoS Profile for your site-based remote network.

      Be sure that you create the QoS profile in the Remote_Network_Template.
2. From the Panorama that manages Prisma Access, go to Cloud ServicesConfigurationRemote NetworksBranch Sites and Add a site.

3. Give the remote network a descriptive Site Name.
4. Enter the site's City and Country.

   For more precise searches, add an address.

5. Go to the Next screen.
6. Select a committed information rate (CIR), a primary location, and, optionally, a secondary location.

   1. To secure and commit the amount of bandwidth used per site, specify a CIR in Mbps.

      Enter a minimum CIR of 1 Mbps and a maximum of 3000 Mbps. Don't exceed the bandwidth you specify for the compute region.

      If there are multiple remote networks that share bandwidth in a compute location, the Remote Network—High Performance receives at least the bandwidth specified in the CIR when there is contention with other sites in that compute location.

      If you configure primary and secondary sites, you specify different compute regions and the secondary region gets 20% of the CIR. For example, if you configure a CIR of 100 Mbps to a site, Prisma Access provides the primary site with 100 Mbps CIR and the secondary site with 20 Mbps CIR.

      If the CIR is 500 Mbps and if all remaining bandwidth in the compute location is used by other sites, Prisma Access drops any bandwidth in excess of 500 Mbps. However, if other sites are not using bandwidth, the bandwidth for the high-performance remote network can go above 500 Mbps up to the allocated bandwidth in the compute location.

      If you have multiple remote networks that share bandwidth in a compute location, and if there is bandwidth contention with other sites in that compute location, the Remote Network—High Performance receives at least the bandwidth specified in the CIR.
   2. Select a Primary Location and a Primary CIR.

      Prisma Access recommends the locations to onboard and shows the available bandwidth to allocate for that location, If you select a location in a compute location that does not have sufficient bandwidth, you can either select a location in a compute location that has sufficient bandwidth or allocate bandwidth to the compute location.
   3. (Optional) To create a secondary (backup) site, select Allow connection to a secondary Prisma Access Location as backup when necessary and then select a Secondary Location and, optionally, a Secondary CIR if you want the secondary location to have a different CIR than the primary location.

      If you select this choice, Prisma Access prepopulates the best secondary location or locations that are in a different compute location than the primary location. If multiple locations are Recommended; select the location that works best for your deployment.
   4. (Optional) If you want to enable QoS for your site, select the QoS Profile you created at the start of this procedure and go to the Next step.

7. Define Tunnel & Circuit Settings.

   1. Select a Tunnel Mode: either Active/Active or Active/Passive.

      The tunnel mode specifies how many of your ISP circuits you want to utilize for the remote network. Specify a minimum of one circuit and a maximum of four circuits.

      • If you select Active/Passive (the default setting), Prisma Access utilizes either one or two ISP circuits to create two active tunnels. If the active tunnel goes down, the passive tunnel becomes active.
      • If you select Active/Active, Prisma Access Prisma Access utilizes either two or four ISP circuits to create either two or four active tunnels, respectively.
   2. Select the Number of circuits to use.

      Prisma Access assigns tunnels based on the number of circuits you specify here, and whether your deployment is Active/Active or Active/Passive, as shown in the following table.
   3. Select the IPSec tunnels to use for your primary location and secondary location by selecting either:

      • One of the predefined IPSec templates in the Remote_Network_Template
      • An IPSec tunnel you created at the start of this procedure.

   4. Go to the Next step.
8. Choose your Routing Settings.

   • Select the Routing Type (either Static or Dynamic).
     If you select Static routing, Add the IP subnets or IP addresses that you want to secure at the site.
     Only use static routing in active/passive mode; Palo Alto Networks recommends that you set up BGP routing in active/active mode.
     If you select Dynamic routing:
     • Enter the Peer AS (the autonomous system (AS) for your network).
       Use an RFC 6996-compliant BGP Private AS number.
     • Enter the Peer IP Address assigned as the Router ID of the eBGP router on the HQ or data center network.
     • (Optional) Enter a Shared Secret password to authenticate BGP peer communications.
     • Enter the Local Address that Prisma Access uses as its Local IP address for BGP.
     • (Optional) Select Summarize Mobile User Routes before advertising to reduce the number of mobile user IP subnet advertisements over BGP to your CPE by having Prisma Access summarize the subnets before it advertises them.
     • (Optional) Select Advertise Default Route to have Prisma Access originate a default route advertisement for the remote network using eBGP. Be sure that your network does not have another default route advertised by BGP, or you could introduce routing issues in your network.
     • (Optional) Select Don't Export Routes to prevent Prisma Access from forwarding routes into the HQ or data center.

   If you have a secondary tunnel, the BGP settings copy over; you can use the copied-over settings for the secondary tunnel or modify those settings.

9. Click OK to save your changes.
10. Go to CommitCommit and Push and Commit and Push your changes.

11. Find the Service Endpoint address (the IP or FQDN address you use on your CPE to terminate the IPSec tunnel).

    As a best practice, specify the FQDN instead of the IP address.

    1. Go to Cloud ServicesConfigurationRemote NetworksPrisma Access.
    2. Find the Service Endpoint address.